https://github.com/strukturag/libde265/commit/1475c7d2f0a6dc35c27e18abc4db9679bfd32568.patch
Patch came straight from upstream.
To be removed with libde265-1.0.15 or later.

From 1475c7d2f0a6dc35c27e18abc4db9679bfd32568 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Thu, 23 Nov 2023 19:43:55 +0100
Subject: [PATCH] possible fix for #435

---
 libde265/motion.cc | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libde265/motion.cc b/libde265/motion.cc
index 6645f8b6..73b88eb7 100644
--- a/libde265/motion.cc
+++ b/libde265/motion.cc
@@ -1864,7 +1864,14 @@ void derive_spatial_luma_vector_prediction(base_context* ctx,
       logmvcand(vi);
 
       const de265_image* imgX = NULL;
-      if (vi.predFlag[X]) imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]);
+      if (vi.predFlag[X]) {
+        if (vi.refIdx[X] < 0 || vi.refIdx[X] >= MAX_NUM_REF_PICS) {
+          return;
+        }
+
+        imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]);
+      }
+
       const de265_image* imgY = NULL;
       if (vi.predFlag[Y]) {
         if (vi.refIdx[Y] < 0 || vi.refIdx[Y] >= MAX_NUM_REF_PICS) {